2-Step Verification adds a second confirmation step at login, on top of a password. Most of the friction people run into falls into a small number of predictable categories.
Enrollment problems
Users sometimes lose access to the phone number or authenticator app used during enrollment, particularly after a device change. Setting up backup codes at enrollment time — not after a lockout — is the difference between a five-minute fix and a support ticket.
Organization-wide rollout
Enforcing 2-Step Verification for an entire organization at once, without a grace period, is a common cause of a wave of lockouts on the rollout day. A short enrollment window where it is available but not yet mandatory gives people time to set it up on their own schedule.
Admin lockout risk
If the person managing 2-Step Verification policy is also enrolled in it, losing their own second factor can lock them out of the very console needed to fix it. Keeping at least one admin account with backup codes stored somewhere separate from the primary device avoids this specific failure mode.